Extracted

• • Target

    shellcode.exe

  • Size

    1.0MB

  • MD5

    09ea8a8f6f4b41e779c728bb9060e21d

  • SHA1

    1bb85f6634b32ead5eb164bc7bf80aa36299e006

  • SHA256

    1df4dc12c0118cb36a33456ace897124540bc1d6553554ad7334bee2ae8aa834

  • SHA512

    6019ceeba9f6ee6dc1ddacf2f12324b71a18172eb975977de01e50c2eca6b6162630395423800c8c222f7b0387cef2be8b896038d2484be187d1e8500079662f

  • SSDEEP

    1536:vh3LTV30kb217S/Y4rGm/It3Rg7UvDafGRyF6v:vBLTV30717UBGH9RAUvDKeW6v

  Score

  10^/10

  formbookguloadercprpdownloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2